I've setup a VTI on two 2821 routers which both have ZFW deployed on them. Without ZFW on the VTI works between the two routers and all traffic passes freely. When I turn on ZFW (basic FW using the wizard) no traffic flows over the VTI. The VTI is up but I cannot ping across it and/or run OSPF. So, the questions I have are:
â¢ Do I need to create a zone pair (along with the appropriate class-map and policy-map) between the internal interface and the tunnel interface and vice versa?
â¢ Do I need to create a zone pair between the outside interface and some internal interface?